data to display on the latest event of a week.

[DataOrg]

i have 5 weeks of data and data is collected only once in a week. if sometime in a week the script is triggered twice there will cause a duplicate entry but it will not happen every week.
i want to display data "ALL time" but i want to pick and display the latest event indexed in each week in the span of 1 week and i want the span to pick data from Saturday to Friday.

[whrg · Accepted solution]

Hi! My thoughts are this:
First, you calculate the week number. You need to add a day (86400 seconds) to _time because in your case the week starts with a Saturday.
Next, you calculate the latest timestamp for each week number using eventstats.
Last, you filter for latest timestamps per week.

| your base search
| eval weeknumber=strftime(_time+86400,"%U")
| eventstats latest(_time) as latest_time_by_week by weeknumber
| where _time=latest_time_by_week

[inventsekar]

Do you have some sample data/logs please?

[DataOrg]

@inventsekar
sample data

ID   SITENAME   desc    line1   line2   line3   TIMESTAMP   _time
1    abc      horlicks    1 1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.647
2   abc     boost   0   0   0   2018-10-26 06:44:41.647 2018-10-28 06:44:41.648
3   abc complan 1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.649
4   abc horlicks    1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.650
5   abc boost   0   0   0   2018-10-26 06:44:41.647 2018-10-28 06:44:41.651
6   bbc complan 1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.652
7   bbc horlicks    1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.653
8   bbc boost   0   0   0   2018-10-26 06:44:41.647 2018-10-28 06:44:41.654
9   bbc complan 1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.655
10  bbc horlicks    1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.656
11  ccd boost   0   0   0   2018-10-26 06:44:41.647 2018-10-28 06:44:41.657
12  ccd complan 1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.658
13  ccd horlicks    1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.659
14  ccd boost   0   0   0   2018-10-26 06:44:41.647 2018-10-28 06:44:41.660
15  ccd complan 1   1   1   2018-10-26 06:44:41.647 2018-10-28 06:44:41.661

i want results to be displayed like. host sum(line1) sum(line 2) sum(line3)
host line1 line2 line3
abc 10 11 14
bbc 12 52 60
ccd

[DataOrg]

@mstjohn_splunk . help needed